nRF9160 - Using ECC accelerator from user application?

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Fri, 07 Jan 2022 16:29:59 GMT

Anyway, i don't want to spend more time into this. Using RFC9146 the ecc stuff is intended to run once a week, so not big thing, if that takes then some more seconds, at least not in a preview example ;-).

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Fri, 07 Jan 2022 16:28:02 GMT

;-( ;-( ;-(

even with the page you referred to vscode-nrf-connect the link for linux - setting up the project show

404 Not Found

RE: nRF9160 - Using ECC accelerator from user application?

Einar Thorsrud — Fri, 07 Jan 2022 14:29:14 GMT

Hi,

That is odd. It should just work after you have followed the instructions for installing the nRF Connect SDK dependencies and point to the SDK files and toolchain (use "PATH" as you write) for the latter. You can do this from "Quick Setup" in the nRF Connect for VS code welcome page (which just writes to the workspace settings file for you).

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Thu, 06 Jan 2022 20:02:34 GMT

I have to give up ;-(.

Beside of the nice movies how to install it on windows, the instructions for ubuntu maybe either broken or incomplete.

The build works nice from the command-line, but VS Code seems to depend on a setup, which is unclear.

It asks to configure "nRF Connect Toolchain". using PATH fails. Even after sourcing zephyr-env.sh. In the end, it just takes too much time.

Edit:

Even VS Code complained about PATH, it wasn't the cause. It seems to miss GNUARMEMB_TOOLCHAIN_PATH, which isn't required, if I run it from cmd-line. With that I was able to build it. The debug-build then fails again ...

So, my conclusion: too much time to find too many small things ;-).

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Wed, 05 Jan 2022 20:25:54 GMT

Thanks!

(Sorry, that my answers seems to be mixed up an unordered, but the "reply" button in this forum is really a myth to me.)

cmd-line works (I already wrote that above).

And I will give VS code a try tomorrow.

RE: nRF9160 - Using ECC accelerator from user application?

Einar Thorsrud — Wed, 05 Jan 2022 19:28:42 GMT

Hi,

Ah, I see. Unfortunately there are issues building many of the crypto samples with SES. I recommend either building from command line, or using the new nRF Connect for VS Code addon, which in most regards are better for nRF Connect SDK development than SES. Pleas try to build from the command line and see if that works. If it does, your toolchain etc. is OK, and then it will also work from VS Code (which unlike SES only calls underlying tools for the build process).

(You can get the same as --pristine from SES by opening the project again and selecting to clean the build folder (or just close SES, delete the build folder, then open the project again).)

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Wed, 05 Jan 2022 17:06:21 GMT

Cool. Using the cmd-line works "on my machine" as well.

So the question is then: which IDE could be used? Or is using a IDE not intended?

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Wed, 05 Jan 2022 16:39:58 GMT

Sorry, my browser (Firefox) sometimes doesn't show the reply. And sometimes it appears then suddenly (No, I don't have too much trouble with other sides ;-) ).

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Wed, 05 Jan 2022 16:38:01 GMT

I use SES 5.68 on Ubuntu 18.04.

Executing nrf-connect 3.9.1 (on Ubuntu 18.04) and starting "toolchain manager v0.10.1" I get unfortunately "linux is currently not supported by this app". I followed the linux install description. Though I can build a lot of samples, so it should not be that wrong.

So:

is it required to use Windows?

Is it required to use cmd-line, SES is not working?

If I try to open the "tfm_hello_world" in SES, I get

Creating solution tfm_hello_world.emProject
cmake -GNinja -DBOARD=thingy91_nrf9160_ns -DBOARD_DIR=/home/achim/repos/ncs-1.8.0/nrf/boards/arm/thingy91_nrf9160 -B/home/achim/repos/ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/build_thingy91_nrf9160_ns -S/home/achim/repos/ncs-1.8.0/nrf/samples/tfm/tfm_hello_world -DZEPHYR_TOOLCHAIN_VARIANT=gnuarmemb -DGNUARMEMB_TOOLCHAIN_PATH=/opt/gcc-arm-none-eabi-9-2019-q4-major -DEXTRA_KCONFIG_TARGETS=menuconfig_ses -DEXTRA_KCONFIG_TARGET_COMMAND_FOR_menuconfig_ses=/usr/share/arm_segger_embedded_studio_v568_linux_x64_nordic/html/configure_nordic_project_menuconfig.py
-- Application: /...../ncs-1.8.0/nrf/samples/tfm/tfm_hello_world
-- Zephyr version: 2.7.0 (/..../ncs-1.8.0/zephyr), build: v2.7.0-ncs1
-- Found Python3: /usr/bin/python3.6 (found suitable exact version "3.6.9") found components: Interpreter
-- Found west (found suitable version "0.12.0", minimum required is "0.7.1")
-- Board: thingy91_nrf9160_ns
-- Cache files will be written to: /..../.cache/zephyr
-- Found dtc: /..../bin/dtc (found suitable version "1.6.0", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (/opt/gcc-arm-none-eabi-9-2019-q4-major)
-- Found BOARD.dts: /..../ncs-1.8.0/nrf/boards/arm/thingy91_nrf9160/thingy91_nrf9160_ns.dts
-- Generated zephyr.dts: /..../ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/build_thingy91_nrf9160_ns/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /..../ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/build_thingy91_nrf9160_ns/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /..../ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/build_thingy91_nrf9160_ns/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /..../ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/build_thingy91_nrf9160_ns/zephyr/dts.cmake

(.... is "/home/username/repos")

You use "--pristine", is that important? Could that be added using SES 5.68 as well?

RE: nRF9160 - Using ECC accelerator from user application?

Einar Thorsrud — Wed, 05 Jan 2022 09:59:22 GMT

Hi,

I am not able to reproduce this. Both nrf/samples/crypto/ecdh and nrf/samples/tfm/tfm_hello_world from 1.8 should build as expected with "west build -b nrf9160dk_nrf9160_ns --pristine".

Can you ensure that you have not done any changes in the nRF Connect SDK files, and also that you use the 1.8 toolchain from the toolchain manager?

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Tue, 04 Jan 2022 21:17:28 GMT

I also tried the tfm_hello_world.

That even doesn't pass the configuration ...

Merged configuration 'ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/child_image/mcuboot.conf'
-- Configuring incomplete, errors occurred!
-- Configuring incomplete, errors occurred!
See also "ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/build_thingy91_nrf9160_ns/CMakeFiles/CMakeOutput.log".
See also "ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/build_thingy91_nrf9160_ns/CMakeFiles/CMakeError.log".
Including boilerplate (Zephyr base): /ncs-1.8.0/zephyr/cmake/app/boilerplate.cmake
thingy91_nrf9160_ns.dts.pre.tmp:367.32-371.5: Warning (simple_bus_reg): /soc/cryptocell-sw: missing or empty reg/ranges property
thingy91_nrf9160_ns.dts.pre.tmp:60.42-72.3: Warning (unique_unit_address_if_enabled): /soc/peripheral@40000000/flash-controller@39000: duplicate unit-address (also used in node /soc/peripheral@40000000/kmu@39000)
thingy91_nrf9160_ns.dts.pre.tmp:312.19-318.3: Warning (unique_unit_address_if_enabled): /soc/peripheral@40000000/clock@5000: duplicate unit-address (also used in node /soc/peripheral@40000000/power@5000)
Changed board to secure thingy91_nrf9160 (NOT NS)

=== child image mcuboot - begin ===
Including boilerplate (Zephyr base): ncs-1.8.0/zephyr/cmake/app/boilerplate.cmake
thingy91_nrf9160.dts.pre.tmp:60.42-72.3: Warning (unique_unit_address_if_enabled): /soc/peripheral@50000000/flash-controller@39000: duplicate unit-address (also used in node /soc/peripheral@50000000/kmu@39000)
thingy91_nrf9160.dts.pre.tmp:312.19-318.3: Warning (unique_unit_address_if_enabled): /soc/peripheral@50000000/clock@5000: duplicate unit-address (also used in node /soc/peripheral@50000000/power@5000)

ncs-1.8.0/nrf/samples/tfm/tfm_hello_world/child_image/mcuboot.conf:2: warning: attempt to assign the value '"UART_1"' to the undefined symbol UART_CONSOLE_ON_DEV_NAME

error: Aborting due to Kconfig warnings

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Tue, 04 Jan 2022 16:24:50 GMT

I tried "ncs-1.8.0/nrf/samples/crypto/ecdh". I get a build failure:

Building 'zephyr/zephyr_prebuilt.elf' from solution 'build' in configuration 'Common'
2> Compiling 'empty_file.c'
1> Linking 'zephyr_prebuilt.elf'
1> /opt/gcc-arm-none-eabi-9-2019-q4-major/bin/../lib/gcc/arm-none-eabi/9.2.1/../../../../arm-none-eabi/bin/ld.bfd: modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a(bignum.c.obj): in function `mbedtls_mpi_read_binary_le':
1> /home/achim/repos/ncs-1.8.0/mbedtls/library/bignum.c:845: multiple definition of `mbedtls_mpi_read_binary_le'; modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a(ecp_oberon.c.obj):/home/achim/repos/ncs-1.8.0/nrfxlib/nrf_security/src/mbedtls/oberon/ecp_oberon.c:91: first defined here
1> /opt/gcc-arm-none-eabi-9-2019-q4-major/bin/../lib/gcc/arm-none-eabi/9.2.1/../../../../arm-none-eabi/bin/ld.bfd: modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a(bignum.c.obj): in function `mbedtls_mpi_write_binary_le':
1> /home/achim/repos/ncs-1.8.0/mbedtls/library/bignum.c:920: multiple definition of `mbedtls_mpi_write_binary_le'; modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a(ecp_oberon.c.obj):/home/achim/repos/ncs-1.8.0/nrfxlib/nrf_security/src/mbedtls/oberon/ecp_oberon.c:124: first defined here
1> collect2: error: ld returned 1 exit status
Build failed

Any ideas?

RE: nRF9160 - Using ECC accelerator from user application?

Achim Kraus — Tue, 04 Jan 2022 15:14:18 GMT

Thanks.

I will try these crypto examples.

RE: nRF9160 - Using ECC accelerator from user application?

Einar Thorsrud — Tue, 04 Jan 2022 13:17:01 GMT

Hi,

It is not possible to communicate with the modem from secure mode, so implementing the application (at least the parts of it that communicate with the modem) is a hard requirement. This cannot be changed. Also, as you noted, the CryptoCell (crypto accelerator) can only be used from secure mode. There has been support for using the RNG from CryptoCell from SPM, but support for other features including ECC is not implemented there. For that, you should look at TF-M, which is intended to replace SPM and also provide extended functionality. TF-M is currently experimental, but is the only solution Nordic provide for this. You can see how it is used by referring to the Crypto examples. If you build for non-secure, TF-M is automatically included.